1361 matches found
SAP HANA Application Lifecycle manager - CSRF token bypass (Verb tampering)
Application: SAP HANA Versions Affected: 1.00.60.379371 Vendor URL: http://www.sap.com Bugs: CSRF token bypass Verb tampering Reported: 09.04.2014 Vendor response: 10.04.2014 Date of Public Advisory: 21.08.2014 Reference: SAP Security Note 2011169 Author: Dmitry Chastukhin ERPScan Description It ...
Avira Service - Unvalidated CSRF Token Account Hijacking
Document Title: =============== Avira Service - Unvalidated CSRF Token Account Hijacking References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1301 View: https://www.youtube.com/watch?v=lJR8Hv5JnOI Release Date: ============= 2014-08-28 Vulnerability Laboratory ID VL-ID:...
Avira Service - Unvalidated CSRF Token Account Hijacking
Document Title: =============== Avira Service - Unvalidated CSRF Token Account Hijacking References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1301 View: https://www.youtube.com/watch?v=lJR8Hv5JnOI Release Date: ============= 2014-08-28 Vulnerability Laboratory ID VL-ID:...
CVE-2014-5205
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...
WordPress < 3.7.4 / 3.8.4 / 3.9.2 Multiple Vulnerabilities
According to its version number, the WordPress application hosted on the remote web server is affected by multiple vulnerabilities : - An XML injection flaw exists within 'getid3.lib.php' due to the parser accepting XML external entities from untrusted sources. Using specially crafted XML data, a...
EFF Releases Open Wireless Router Firmware
The EFF is working on an open wireless router firmware that’s designed to be a secure and flexible alternative to the existing software that runs on home and small business routers, much of which is notoriously insecure. The Open Wireless Router project, which the organization announced at the HO...
Netsparker v3.5 - Web Application Security Scanner
Netsparker Web Application Security Scanner can find and report web application vulnerabilities such as SQL Injection and Cross-site Scripting XSS and security issues on all web applications and websites regardless of the platform and the technology they are built on. Netsparker is very easy to u...
Wordpress WPTouch Authenticated File Upload
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Wordpress WPTouch Authenticated File Upload', 'Description' = %q The Wordpress WPTouch plugin contains an auhtenticated file upload...
WordPress WPTouch Authenticated File Upload
The WordPress WPTouch plugin contains an authenticated file upload vulnerability. A wp-nonce CSRF token is created on the backend index page and the same token is used on handling ajax file uploads through the plugin. By sending the captured nonce with the upload, we can upload arbitrary files to...
Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4...
Wordpress 3.3.1 - Multiple CSRF Vulnerabilities
No description provided by source. +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-2012 Author : Ivano Binetti...
Axous 1.1.1 - Multiple Vulnerabilities (CSRF - Persistent XSS)
No description provided by source. +-----------------------------------------------------------------------------------------------------------+ Exploit Title : Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Date : 30-04-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software...
Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities
No description provided by source. +------------------------------------------------------------------------------+ | HOTBOX is the leading router/modem appliance of | | HOT Cable communication company in israel. | | The Appliance is manufactured by SAGEMCOM | | and carries the model name F@st...
Katello (Red Hat Satellite) users/update_roles Missing Authorization
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize super 'Name' = 'Katello Red...
Uzbey: Breach Attack Vulnerability
Breach Attack Vulnerability Respected Sir/Madam I Hope Your Cooperate With Me Cause It's Not Easy To Find Vulnerability On Your Official Website. Vulnerability description This web application is potentially vulnerable to the BREACH attack.An attacker with the ability to: Inject partial chosen...
Lack of CSRF protection on Voting
panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47905. panel On Confluence Questions, answers and questions can be upvoted by the victim automatically on a question page visit...
openSUSE Security Update : python-django (openSUSE-SU-2013:1685-1)
python-django was updated to version 1.5.5 : + Readdressed denial-of-service via password hashers CVE-2013-1443 + Properly rotate CSRF token on login %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...
Coinbase: Leaking CSRF token over HTTP resulting in CSRF protection bypass
Start a proxy tool like Burp. 2. Authenticate to the Coinbase application. 3. Navigate to the URL https://coinbase.com/docs/api/overview 4. Under Developer Updates, enter your email address and click "Subscribe". 5. Notice that this request is sent over HTTP with the CSRF token in the body of...
Flash cross-domain data hijacking vulnerability,a large wave of site affected-vulnerability warning-the black bar safety net
0×0 1，Background Many of the uploaded file to the back-end logic in the realization, only validate the file extension and Content-Type, not uploading the contents of the file for verification. Typically such processing logic is simply not rigorous, will not cause too much of a security risk. But...
Factlink: X/Csrf token problem
I found that you are using X/Csrf token as a protection against CSRF attacks. But you are using same X/Csrf token in and out. eg z3qrwilV8lz7CXsMhmvqxn+93GDZm/m9w/d5DZjoj8w= This token is same before and after log-in. This must be patch as it me result session hacks...